AIKIDO-2026-608659

braintree is vulnerable to Path Traversal

Path Traversal Pre-CVE Published Aug 11, 2026

Medium Risk

This Affects:

braintree

1.0.0 - 4.39.0

Fixed in 4.40.0

Are you affected? Scan for Free

TL;DR

The AddressGateway builds HTTP request paths by interpolating the caller-supplied address_id directly into the URL for the find, update, and delete operations. Before 4.40.0 that address_id was not validated (only a nil/blank guard on find, nothing on update/delete), so when an application forwards an externally influenced identifier, a value containing path separators or relative-path segments such as ../../foo can alter the intended endpoint and reach unintended API paths. The related customer_id, dispute_id, and evidence_id identifiers were already validated by an equivalent character allowlist; the fix adds a shared Util.invalid_path_segment? helper and, critically, now applies it to address_id as well.

Who does this affect?

You are affected if you are running a version in the vulnerable range and your application passes an externally influenced identifier as the address_id argument to AddressGateway#find, #update, or #delete (for example an id derived from an incoming request). The customer_id, dispute_id, and evidence_id paths were already validated before this release, so they are not the vector.